Extracted

• • Target

    dllhost.bat

  • Size

    658KB

  • MD5

    19ff0b8faebbeca871f17a931bffdf1a

  • SHA1

    433d123f4733bb8cc867b2110858727e530ec7e4

  • SHA256

    c96325777c1db10cc8d7fd4371cd29d8a4fcba2ea5a421d296df36b072355333

  • SHA512

    e9a0af471d8cf5799631ae5bbb8e764f9aef885f67001ba9997d938e11b7198e921d945c9eed91441a5a0773145c2e19fae5e2af2a89424c0e3d9fec2c7545fa

  • SSDEEP

    12288:C9HMeUmcufrvA3kb445UEJ2jsWiD4EvFuu4cNgZhCiZKD/XdyF3:uiBIGkbxqEcjsWiDxguehC2Sw

  Score

  10^/10

  darkcometguest16discoverypersistencerattrojan

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

    trojanratdarkcomet

  • Darkcomet family

    darkcomet

  • Modifies WinLogon for persistence

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1